Cover certificate KRL revocations

crates/geth-ssh-identity/src/lib.rs

@@ -603,4 +603,84 @@ mod tests {
                 .contains("revoked")
         );
     }
+
+    #[test]
+    fn openssh_krl_binary_export_revokes_certificate_when_ssh_keygen_available() {
+        if ensure_ssh_keygen_available().is_err() {
+            return;
+        }
+
+        let dir = tempfile::tempdir().expect("tempdir");
+        let ca_key_path = dir.path().join("ca");
+        let user_key_path = dir.path().join("user");
+        let ca_status = Command::new("ssh-keygen")
+            .arg("-q")
+            .arg("-t")
+            .arg("ed25519")
+            .arg("-N")
+            .arg("")
+            .arg("-f")
+            .arg(&ca_key_path)
+            .status()
+            .expect("generate ca key");
+        assert!(ca_status.success());
+
+        let user_status = Command::new("ssh-keygen")
+            .arg("-q")
+            .arg("-t")
+            .arg("ed25519")
+            .arg("-N")
+            .arg("")
+            .arg("-f")
+            .arg(&user_key_path)
+            .status()
+            .expect("generate user key");
+        assert!(user_status.success());
+
+        let user_public_key_path = user_key_path.with_extension("pub");
+        let sign_status = Command::new("ssh-keygen")
+            .arg("-q")
+            .arg("-s")
+            .arg(&ca_key_path)
+            .arg("-I")
+            .arg("geth-test-cert")
+            .arg("-n")
+            .arg("eric")
+            .arg("-V")
+            .arg("+1d")
+            .arg("-z")
+            .arg("100")
+            .arg(&user_public_key_path)
+            .status()
+            .expect("sign user certificate");
+        assert!(sign_status.success());
+
+        let cert_path = dir.path().join("user-cert.pub");
+        let certificate = std::fs::read_to_string(&cert_path).expect("read certificate");
+        let entry = SshRevocationEntry {
+            id: "ssh-revocation:cert".into(),
+            kind: SshRevocationKind::Certificate,
+            target: certificate,
+            reason: Some("test certificate revocation".to_owned()),
+            created_at: UnixMillis(1),
+            published: true,
+        };
+        let krl_path = dir.path().join("revoked-certs.krl");
+
+        write_openssh_krl(&[entry], &krl_path, None).expect("write certificate krl");
+
+        let output = Command::new("ssh-keygen")
+            .arg("-Q")
+            .arg("-f")
+            .arg(&krl_path)
+            .arg(&cert_path)
+            .output()
+            .expect("query certificate krl");
+        assert!(!output.status.success());
+        assert!(
+            String::from_utf8_lossy(&output.stdout)
+                .to_ascii_lowercase()
+                .contains("revoked")
+        );
+    }
 }